boxie

Developer documentation · partnership preview

Taskbox

A task runner for Treg. Save your keys once, then submit a task and read the answer. Each task runs in a throwaway workspace that is destroyed the moment it finishes — you get results, not infrastructure to manage.

Preview status: the API is live and self-serve; commercial terms are still being settled. Numbers below were measured 2026-08-24 against the deployed API — nothing on this page is an evergreen claim.

Measured, not promised

The envelope.

Save your keys
once — never re-sent per task
Submit → run id
0.4 s — returns immediately, HTTP 202
Task complete
6.8 s — catalog lookup, one tool call
Workspaces to manage
none — created and destroyed per run

Get started · two calls

Two calls to an answer.

Two calls: save your keys once, then submit tasks. Your Boxie API key is the only credential your code ever sends — the Treg and LLM keys are stored server-side at setup and never travel with a task. There is no workspace to create, no URL or token to keep, and nothing to install.

  1. 01 Save your keys, once

    One call stores your own Treg API key (it is what authorizes and pays for your Treg calls) and, optionally, an Anthropic or OpenAI key. Leave the LLM key out and Boxie's own model covers a few runs a day; add a key for unlimited runs. Keys are stored encrypted, never returned by any endpoint, and never sent again with a task. A Claude or Codex subscription connected on the Agents tab works in persistent Boxes but not here: the Taskbox workspace calls the model API directly.

    configure-once.sh
    # Once per account. The keys are stored encrypted and are
    # never returned by any endpoint — only whether they are set.
    # llmKey is optional: leave it out and the model is on us for a few runs a day.
    curl -X PUT "$BOXIE_API/v1/taskbox/config" \
      -H "Authorization: Bearer $BOXIE_API_KEY" \
      -H "Content-Type: application/json" \
      -d '{"tregKey": "<your treg key>", "llmKey": "<anthropic or openai key>"}'
    
    # -> {"tregConfigured": true, "llmConfigured": true,
    #     "llmProvider": "anthropic", "llmSource": "Taskbox key",
    #     "tregKeyExpiresAt": "2026-09-22T21:43:46Z"}
  2. 02 Submit a task

    Describe what you want done. The call returns immediately with a run id rather than blocking: measured tasks range from about 5 to 35 seconds, and a submit-and-poll shape means a slow task or a dropped connection can never lose a run — or re-bill its metered Treg calls on a retry.

    submit.sh
    # No keys in the request — your account already has them.
    # Returns immediately so a long task cannot be lost to a timeout.
    curl -X POST "$BOXIE_API/v1/taskbox/runs" \
      -H "Authorization: Bearer $BOXIE_API_KEY" \
      -H "Content-Type: application/json" \
      -d '{"prompt": "Find the cheapest paid Google Maps tool and its price."}'
    
    # -> HTTP 202
    #    {"runId": "run_PvHPfLCrfeK_KERgZKg6WA", "status": "running",
    #     "agentEnabled": true, "createdAt": "2026-08-24T01:27:21Z"}
  3. 03 Poll for the answer

    Behind that one id, the platform starts a workspace, runs the agent against the live Treg catalog, records the result, and destroys the workspace. You never see any of it — there is no URL or token in the response, and nothing to clean up.

    poll.sh
    # Poll until status leaves "running" (about 2s between polls).
    curl "$BOXIE_API/v1/taskbox/runs/$RUN_ID" \
      -H "Authorization: Bearer $BOXIE_API_KEY"
    
    # -> {"status": "succeeded",
    #     "answer": "The single cheapest paid Google Maps tool is
    #                dataforseo.x.serp-google-maps-live-advanced at $0.002/call.",
    #     "toolCalls": [{"tool": "treg_catalog_search", "exit": 0}],
    #     "durationMs": 6799}
    #
    # The workspace that produced this was already destroyed. There is no
    # URL or token to keep, and nothing to clean up.
  4. 04 Wire it into your product

    The same two calls from your own backend, with your Boxie API key as the only credential. This is exactly what the dashboard demo does, so what you see there is what your integration will do.

    run-a-task.ts
    // The same two calls from your own backend.
    const headers = {
      Authorization: `Bearer ${process.env.BOXIE_API_KEY}`,
      "Content-Type": "application/json",
    };
    
    const started = await fetch(`${API}/v1/taskbox/runs`, {
      method: "POST",
      headers,
      body: JSON.stringify({ prompt: "Find the cheapest paid Google Maps tool." }),
    }).then((r) => r.json());
    
    let run = started;
    while (run.status === "running") {
      await new Promise((r) => setTimeout(r, 2000));
      run = await fetch(`${API}/v1/taskbox/runs/${started.runId}`, {
        headers,
      }).then((r) => r.json());
    }
    console.log(run.answer);

When it doesn’t work

Unstick yourself.

The four failures new integrations actually hit, and what each one means.

401 {"code": "unauthorized"}
Your Boxie API key is not reaching the API. Every route needs the header Authorization: Bearer <your Boxie API key> — the same key the rest of the API uses. A 401 is always a key problem, never a prompt problem.
400 {"code": "treg_not_configured"}
This account has not saved a Treg key yet. Call PUT /v1/taskbox/config once, then submit again. Keys are per account, so a key saved with one credential is not visible to another.
400 {"code": "provider_not_configured"}
Only returned when Boxie's funded model is switched off and the account has no key. Save an Anthropic or OpenAI API key via PUT /v1/taskbox/config. A Claude or Codex subscription connected on the Agents tab is not enough here: GET /config reports llmSubscriptionOnly: true in that case.
429 {"code": "funded_runs_exhausted"}
Today's funded runs are used up for this account. Save your own Anthropic or OpenAI API key via PUT /v1/taskbox/config for unlimited runs, or try again tomorrow. GET /config shows fundedRunsRemainingToday so you can warn before this happens.
404 {"code": "not_found"} when polling
That run id does not belong to this account, or it never existed. Run ids are account-scoped, so a run submitted with a different key is invisible here.
429 {"code": "rate_limited"}
Three runs are already in flight for this account. Every run costs a real machine, so submissions are capped — poll your existing runs, then submit again.
status stays "running"
Keep polling; a multi-call research task can take ~35s. Runs are capped at five minutes, after which the status becomes failed with a timeout message. The run continues server-side even if your client disconnects.

API reference

Five endpoints.

Every route takes your Boxie API key as a bearer token — the same key you already use for the rest of the API, so there is no second auth concept to integrate. Full request and response schemas, defaults, and failure modes live in the OpenAPI contract.

MethodPathPurpose
PUT/v1/taskbox/configSave your Treg key (and an optional LLM key; without one the model is on us for a few runs a day). Values are write-only.
GET/v1/taskbox/configWhich credentials are configured — never their values.
POST/v1/taskbox/runsSubmit a task. Returns {runId, status} immediately.
GET/v1/taskbox/runs/{runId}Poll one run for {status, answer, toolCalls, durationMs}.
GET/v1/taskbox/runsYour recent runs, newest first.

In-guest agent loop

Four tools, one process.

Your task is carried out by an agent that sees exactly four tools. A finished run lists every one it invoked, so what happened — and what it cost — is auditable per task.

treg_catalog_search
Search ~2,600 catalog endpoints by what you want to do. Free.
treg_catalog_get
Inspect one endpoint — params, price, example — before calling it. Free.
treg_call
Call a catalog endpoint with server-side credentials. Metered per its catalog price.
sharenow_publish
Publish an HTML page anonymously; live URL, public for one hour.

Read before integrating

Sharp edges.

These are the behaviors that surprise integrators. All of them are documented in the contract; the important ones were found the hard way.

Submit and poll, never block
A task is not a request/response call: POST returns a run id and the work continues server-side. That is deliberate — measured tasks run 5–35s, and a blocking API would fail on exactly the valuable ones. It also means a dropped connection cannot lose a run or cause its metered Treg calls to be billed twice on a retry.
Your keys never travel with a task
They are saved once, encrypted, and injected into the workspace server-side. No endpoint returns a key value — GET /config reports only which credentials are set, their provider, and your Treg key's own expiry so you can warn before it lapses.
Metered calls cost real money
Catalog searches are free, but a treg_call is billed at that endpoint's catalog price against your Treg balance. The toolCalls array on a finished run tells you exactly what ran, so cost is auditable per task.
Runs are capped, because machines are real
Three concurrent runs per account and five minutes per run. A run that exceeds its deadline is failed and its workspace destroyed — nothing is left holding a machine.
The model is on us for a few runs a day
Every task here is an agent task. An LLM key is optional: with none saved, Boxie's own model covers a few runs per account per day and GET /config reports llmFunded: true with fundedRunsRemainingToday. Save an Anthropic or OpenAI API key for unlimited runs. A Claude or Codex subscription connected to the account does not apply here: the workspace calls the model API directly and cannot run a CLI.
Workspaces are not reusable
Each task gets a fresh one and it is destroyed on completion, failure, or timeout. Keeping a workspace alive across tasks — useful for building state in a session — is planned as a paid tier, not a free-tier gap.

Security model

One secret per workspace.

Each instance gets a fresh random bearer token at launch and the SDK never reuses one. The preview passes your own Treg key into the guest; production will mint scoped, capped, revocable per-instance Treg identities before any hosted hand-off opens up.

Get the contract